4 ms·
> I see the mantra ‘salt your password hashes!’ > repeated over and over, when its only real > value is against rainbow tables This is dangerously incomplete
by femto113 12y ago
> I see the mantra ‘salt your password hashes!’
> repeated over and over, when its only real
> value is against rainbow tables
This is dangerously incomplete reasoning. Salts
real value is that if multiple password hashes are
Leaked simultaneously then each must be cracked individually. In the Adobe leak password hints were included, which allowed for very easy guessing of passwords, and because there were no salts even if you had no hint if someone else had the same password and an obvious hint you were cracked.
- worklogin 12y agoI was about to make the same post. If a database is popped and people know John123's password, and his hash is the same as Worklogin456's hash, then they know my password.
- nopar8 12y agoI am extremely ignorant about this topic. But I don't think that's how it works. Can someone else weigh in please.
- cheapsteak 12y agounsalted: username | sha256 hash john123 | ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f joe456 | ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f salted: username | salt | sha256 hash john123 | ponies | 98d4c01710b2b775e41b0bf4984f0cec7621ae1dfc4304047b196af46ed589b2 joe456 | beards | 0f7c74279db5daa1f4de41cc7f6acc94651da754c41675dcde8dcf151d14f5bf their passwords are all `password123`